Privacy Policy
At SiteSync, we're committed to protecting your privacy and being transparent about how we handle your data. This policy explains what information we collect, why we collect it, and how you can control your data.
Contents
- Data Controller
- Information We Collect
- Legal Basis for Processing
- How We Use Your Data
- Third-Party Services
- Data Storage and Security
- Your Rights Under UK GDPR
- Marketing Communications
- Cookies and Tracking
- Data Retention
- International Data Transfers
- Children's Privacy
- Changes to This Policy
- Contact Us
1. Data Controller
The data controller responsible for your personal information is:
SiteSync Limited
Company Number: 16778887
Registered Address: 124–128 City Road, London, United Kingdom, EC1V 2NX
Email: info@site-sync.co.uk
2. Information We Collect
Account Information
- Name, email address, and phone number
- Business details and trade information
- Login credentials (encrypted)
Job and Work Data
- Voice recordings you create for job documentation
- Photos and documents you upload
- Job details, scheduling information, and notes
- Customer names and addresses (via Google Places and Ideal Postcodes APIs)
- Timestamps and location data associated with jobs
Financial Information
- Subscription status (for example, trial, active or cancelled). Subscription payments are processed by Apple via the App Store — we never see or store your payment card details
- Invoice and revenue data you generate in the app
Usage and Device Data
- How you use the app (features accessed, time spent, actions taken)
- Device information (browser type, operating system, device model)
- IP address and general location data
External Report Link Submissions
A SiteSync user can send someone (for example, a subcontractor) an external report link so they can log work without a SiteSync account. If you submit work through one of these links, the name, notes and photos you provide are shared with the SiteSync user who sent you the link. That user reviews your submission before it is added to their records.
3. Legal Basis for Processing (UK GDPR)
We process your personal data under the following legal bases:
- Contract Performance: To provide our job tracking and invoicing services to you
- Consent: For voice recordings, marketing emails, and optional features (you can withdraw consent anytime)
- Legitimate Interests: To improve our services, prevent fraud, and analyse usage patterns
- Legal Obligation: To comply with tax, accounting, and other legal requirements
4. How We Use Your Data
We use your information to:
- Provide and maintain the SiteSync service (job tracking, scheduling, documentation)
- Generate AI-powered invoices and reports using OpenAI technology
- Verify and autocomplete addresses using Google Places and Ideal Postcodes APIs
- Check your subscription status (payments are processed by Apple via the App Store)
- Send you service updates, security alerts, and support messages
- Send marketing communications (only with your consent — you can opt out anytime)
- Analyse usage patterns to improve our service and develop new features
- Detect and prevent fraud, security breaches, and technical issues
- Comply with legal obligations and enforce our Terms of Service
5. Third-Party Services
We work with trusted third-party services to deliver our platform. Your data may be shared with:
Hosts our database and manages authentication. Your data is stored securely on their servers.
Processes your voice recordings and job data to generate invoices and reports using AI. Voice data is sent to OpenAI's API for transcription and processing.
Used for address verification and autocomplete functionality when you enter customer locations.
Provides UK address lookup and validation services.
Processes subscription payments, free trials, cancellations and refunds. Apple handles your payment details under its own privacy policy — we never see or store your payment card details.
All third-party services are carefully selected and comply with applicable data protection laws. We have data processing agreements in place where required.
6. Data Storage and Security
Your data is stored securely in Supabase's infrastructure. We implement industry-standard security measures including:
- Encryption in transit (HTTPS/TLS) and at rest
- Secure authentication and access controls
- Regular security audits and monitoring
- Restricted employee access to personal data
- Automatic backups and disaster recovery procedures
Important: While we implement robust security measures, no system is 100% secure. Please use a strong, unique password and enable two-factor authentication if available.
7. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
Right to Access
Request a copy of all personal data we hold about you.
Right to Rectification
Correct inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten")
Request deletion of your data (subject to legal obligations).
Right to Restrict Processing
Limit how we use your data in certain circumstances.
Right to Data Portability
Receive your data in a machine-readable format to transfer to another service.
Right to Object
Object to processing based on legitimate interests or for marketing purposes.
Rights Related to Automated Decision-Making
Request human review of automated decisions (where applicable).
How to Exercise Your Rights
Email us at info@site-sync.co.uk with your request. We'll respond within 30 days. You can also manage most data directly in your account settings.
Right to Complain
If you're unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
8. Marketing Communications
We may send you marketing emails about SiteSync updates, new features, and special offers, but only if:
- You've explicitly opted in to receive marketing communications, or
- You're an existing customer and the marketing relates to similar services (soft opt-in)
You can unsubscribe from marketing emails anytime by:
- Clicking the "unsubscribe" link in any marketing email
- Updating your preferences in your account settings
- Emailing info@site-sync.co.uk
Note: Even if you opt out of marketing, we'll still send you essential service emails (account notifications, security alerts, billing information).
9. Cookies and Tracking
We only use essential cookies and similar technologies that are required for login, security, and core functionality.
We do NOT use:
- Analytics cookies
- Advertising or remarketing cookies
- Third-party tracking for advertising purposes
This section is our cookie policy. If we ever change how we use cookies, we'll update it here.
10. Data Retention
We retain your data for as long as necessary to provide our services and comply with legal obligations:
- Account Data: Until you delete your account or request deletion
- Voice Recordings & Photos: Until you manually delete them from your account
- Job Data: Until account closure or deletion request
- Financial Records: At least 6 years for tax and accounting purposes (UK legal requirement)
- Backup Data: May be retained for up to 90 days after deletion for disaster recovery
When you delete your account, we'll permanently delete your personal data within 30 days, except where we're required by law to retain it (e.g., financial records for tax purposes).
11. International Data Transfers
Some of our third-party service providers (like OpenAI) may process data outside the UK and European Economic Area (EEA). When this happens, we ensure adequate safeguards are in place, such as:
- Standard Contractual Clauses (SCCs) approved by the UK ICO
- Adequacy decisions for countries with equivalent data protection laws
- Binding Corporate Rules for multinational organisations
Your data receives the same level of protection regardless of where it's processed.
12. Children's Privacy
SiteSync is intended for business use by adults aged 18 and over. We do not knowingly collect personal data from children under 18.
If we discover that we've collected data from a child under 18, we'll delete it immediately. If you believe a child has provided us with personal data, please contact us at info@site-sync.co.uk.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect:
- Changes to our services or business practices
- New legal requirements or regulations
- Feedback from users or regulators
When we make material changes, we'll:
- Update the "Last Updated" date at the top of this page
- Notify you via email (for significant changes)
- Display a prominent notice in the app
Your continued use of SiteSync after changes take effect means you accept the updated policy.
14. Contact Us
If you have questions about this Privacy Policy or how we handle your data, please contact us:
SiteSync Limited
124–128 City Road
London, United Kingdom
EC1V 2NX
We aim to respond to all privacy-related enquiries within 5 business days.